About 820,000 current and former public school students in New York City had their personal information compromised in a January hack.
Breaching Illuminate, a taxpayer-funded software company that the city’s Department of Education uses to track grades and attendance, led a hacker to gain access to the names, birthdays, ethnicities, and English-speaking status of students, special education teachers, and free received lunch, sources said.
The students’ Social security numbers and family financial information were not collected by the DOE and have not been compromised, according to the sources.
Education officials on Friday accused Illuminate of failing to encrypt its IO Classroom, Skedula and Pupilpath platforms.
“We are outraged that Illuminate has represented to us and to the schools that industry-standard critical safeguards required by law were in place when they were not,” Chancellor David Banks told The Post, calling for investigations at city, state and federal government agencies federal level.
The DOE said it will send letters to families affected by the injury. The information compromised in the hack was from the 2016-17 school year, officials said.
The department will also investigate Illuminate’s claim that there were heightened security measures.
Schools could continue using the California company’s services through the end of the year, before contracts are reevaluated for the 2022-23 school year, sources said.
Bobson Wong, a math teacher at a Queens high school who frequently uses Skedula to connect with parents, said he must continue to use the platform unless provided with another option.
“I don’t like using it, but I have to use it. I don’t really have a choice,” he said.
The hacked platforms forced the school to ditch its grading and attendance systems for a week in January, causing teachers to lose track of which children were exposed to COVID-19.
“As Skedula got worse, my students’ grades got worse,” Wong said. “My students’ homework completion dropped by 20 to 30 percent.”
Leonie Haimson, co-chair of the Parent Coalition for Student Privacy, told The Post her organization is concerned that releasing students’ sensitive information could negatively affect their future.
Advocates have been “bargaining” with city and state education authorities over student privacy for years, she said.
“My feeling about this is that if the DOE is taking this seriously, as it should, they should fine that provider up to the maximum amount… and terminate contracts with them,” Haimson said.
“This is a real game changer for the DOE, and actually the State Department of Education, to prove they are serious about protecting student privacy,” she continued – and when they don’t, “they have proven that they are not responsible guardians of our children’s privacy.”
Illuminate has raised more than $16 million from DOE schools in the past three years, records show.
The company was also linked to a scandal over ex-Chancellor Richard Carranza’s hiring of a former Illuminate VP, who failed to part with his previous company when he took a $205,000 job in the city in 2018. dollars a year.
“There is no evidence of fraudulent or illegal activity related to this incident,” Illuminate said in a statement.
“The security of the data we hold in our custody is one of our top priorities and we have already taken important steps to prevent this from happening again.”
But families whose private information could fall into the wrong hands made news of the hack nervous about the repercussions.
Ellen McHugh, co-chair of the Citywide Council of Special Education, wondered what the breach meant for students whose disability status was accessible.
“It’s the stuff that turns your stomach,” Hugh said.
The Big Apple public school district is the largest in the country, with approximately 1.1 enrolled students in the districts.
Mayor Eric Adams said in a statement that New York City “will not tolerate bad actors.”
“[We] plan to hold Illuminate fully responsible for our failure to provide our students with the safety and timely notification that the company has promised,” Adams said.
https://nypost.com/2022/03/26/nyc-students-have-personal-data-hacked/ NYC students hacked personal data